Healthcare AI Strategy for Saudi Arabia & the GCC

Healthcare AI strategy for Saudi Arabia and the GCC from an Abu Dhabi-based healthcare AI strategist: regulation, Arabic AI and cross-border data.

A view on healthcare AI strategy for Saudi Arabia and the wider Gulf from Karthik Telidevara, a healthcare AI strategist based in Abu Dhabi who works across the Middle East.

Perspective, Stated Plainly

I am based in Abu Dhabi, where I work as Manager – AI Strategy & Transformation at Burjeel Holdings. My hands-on deployment experience is in the UAE. I follow healthcare AI across the Gulf closely because the countries share many of the same challenges, but I want to be clear that this page is a strategic perspective, not a list of Saudi or GCC projects.

I also think it is useful to say what this page is not. It is not legal advice, it does not describe confidential work, and it does not claim regional deployments that have not happened. Where I mention regulation, I describe it at a general level, and organisations should always confirm current requirements with qualified local advisers before making decisions.

What I can offer is a practitioner's view of what it takes to move healthcare AI from pilot to production in a Gulf health system, and an honest assessment of which of those lessons travel well across borders and which need local adaptation.

The ideas here build on more than 13 years spanning pharmacy and drug analysis, healthcare business strategy, hospital operations, digital transformation and production AI on the Microsoft and Google ecosystems.

The Regional Context: Ambition Meets Regulation

Saudi Arabia's health transformation under Vision 2030 has made healthcare one of the most active areas for AI investment in the region. The Saudi Data and AI Authority (SDAIA) sets national direction on data and AI, and the Personal Data Protection Law (PDPL) governs how personal data, including health data, is collected, processed and transferred.

At a general level, PDPL means data residency and cross-border transfer have to be planned from the beginning. Health organisations need to know where data is stored, which processing happens where, and what legal basis applies to each flow. The specific rules evolve and should always be checked against current guidance and qualified legal advice; the strategic point is that architecture and compliance cannot be separated.

For hospital leaders, this means involving legal, compliance and information security teams at the very start of any AI programme, not at the procurement stage. It also means asking vendors precise questions about where prompts are processed, where logs are stored, which subcontractors are involved and how data can be deleted, and getting those answers in writing.

Other GCC states have their own data protection laws and health regulators. The common thread is that sovereignty over health data is taken seriously across the region, and AI programmes that assume they can freely move data to any cloud region will run into trouble.

Arabic-Language AI Is a Clinical Requirement

In Gulf healthcare, Arabic is not a nice-to-have localisation layer. Patients describe symptoms in Arabic and in local dialects, often mixed with English medical terms. Clinical staff come from many countries and switch languages through the day. Any AI that touches patient communication has to cope with this naturally.

That affects model choice and evaluation. Speech recognition, translation and summarisation need to be tested on realistic Gulf Arabic, not just formal Modern Standard Arabic, and evaluation sets should be built with native-speaking clinicians. Voice agents in particular must know when they have not understood and hand over to a person, rather than guessing.

Recent progress in multilingual models from Google and Microsoft makes this more achievable than it was, as I discussed in Gemini Live Translate for UAE healthcare, but it still needs careful local testing before it is trusted with patients.

Cross-Border Data and Multi-Country Health Groups

Several healthcare groups in the region operate in more than one GCC country. For them, cross-border data is the most important architectural question in any AI programme. A model or analytics layer that works beautifully in one country may not be allowed to see data from another.

A practical pattern is to keep patient-identifiable data in-country, run inference in approved local regions, and share only what is permitted across borders, such as model configurations, evaluation methods, de-identified aggregates and governance templates. Both Microsoft Azure and Google Cloud offer regional deployment options in the Gulf that support this kind of design, though availability should be checked per service and per country.

This approach also makes regulatory conversations easier, because each country's data stays under its own rules while the organisation still benefits from shared know-how.

How Lessons From UAE Deployments Transfer

Some lessons from my work in the UAE apply almost anywhere in the Gulf. Start with a governance committee that includes clinical, operational, IT, legal and quality voices. Baseline KPIs before you build. Run a controlled pilot with clear exit criteria and clinical validation. Scale only on evidence. None of that depends on which country you are in.

Use cases transfer reasonably well too. Ambient clinical documentation and voice AI agents for patient follow-up and rebooking address problems every hospital has. The integration details, regulators and data rules change, but the shape of the solution and the way you measure it stay similar. The AI voice agents in healthcare guide describes that shape.

What does not transfer automatically is the specific regulatory approval, the integration with each country's health information systems, and the language and cultural tuning. Those must be done locally, with local partners and specialists.

Building a Regional Healthcare AI Roadmap

For an organisation planning healthcare AI across Saudi Arabia and the GCC, I would suggest a roadmap with three layers. The first is a shared foundation: platform choices, security baseline, evaluation methods and governance templates that every country uses. The second is country-specific compliance and integration. The third is a small portfolio of use cases chosen for measurable impact.

Sequencing matters. It is usually better to prove one or two use cases properly in one country, document the evidence, and then adapt them for the next market, than to launch everywhere at once and struggle to show results anywhere.

For the general method, see the healthcare AI strategy framework. For the controls side, see healthcare AI security and governance. For my UAE work, see Healthcare AI Expert in the UAE and the press page.

Frequently Asked Questions

Does Karthik work on projects in Saudi Arabia?

Karthik is based in Abu Dhabi and his deployment experience is in the UAE. This page offers a strategic perspective on healthcare AI across Saudi Arabia and the GCC; it does not describe Saudi client projects.

How does PDPL affect healthcare AI in Saudi Arabia?

At a general level, the Personal Data Protection Law requires organisations to plan how health data is stored, processed and transferred, including across borders. Specific requirements should always be confirmed against current SDAIA guidance and legal advice.

Why is Arabic-language AI important in GCC healthcare?

Patients and staff communicate in Arabic, local dialects and English. Speech, translation and summarisation tools must be tested on realistic Gulf Arabic and must hand over to a human when unsure.

Which lessons from UAE healthcare AI transfer to the GCC?

Governance committees, KPI baselining before build, controlled pilots with clinical validation, and evidence-based scaling transfer well. Regulatory approvals, local system integration and language tuning must be done in each country.